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SECTION 1 


INTRODUCTION 


One way to lower the cost of aircraft is to improve the integra- 
tion of avionics functions. Currently, there is considerable interest 
in replacing the multiple flight-control sensors of a typical modern com- 
mercial aircraft with a skewed array of strapdown inertial navigation 
sensors, using redundant computers to perform multiple functions such as 
flight control, air-data processing, and strapdown navigation. Net cost 
has been shown to be less than for current nonintegrated systems. This 
integrated avionics approach depends upon redundancy to achieve the re- 
liability needed in flight-control loops. In order to achieve various 
performance and economic improvements, the next generation of aircraft 
will be designed to depend upon the flight-control avionics for flight 
stability. Because flight-control-system reliability and safety depend 
upon integrated avionics reliability, thorough analysis of skewed-sensor- 
system reliability is therefore essential. 

The objective of this study was to define and develop techniques 
which will be the basis for failure-detection and isolation (FDI) algo- 
rithms for a NASA-owned dual- fail/operational redundant strapdown iner- 
tial navigation system. These techniques will provide the government 
with the capability for testing and evaluating dual-fail/operational con- 
cepts. The FDI techniques chosen include provisions for hard- and soft- 
failure detection in the context of flight control and navigation. The 
algorithms are of minimum complexity, suitable for flight testing. Anal- 
yses were done to determine error-detection and switching levels for the 
inertial navigation system, which is intended to be of 5- to 10-kilometer- 
(3- to 5-nautical-mile-) per-hour quality for a conventional takeoff 
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or landing (CTOL) operating environment. Analyses of false alarms are 
also included for the FDI techniques developed, as are the analyses of 
filters to be used in conjunction with FDI processing. 

Two specific FDI algorithms were compared in this study: the 

Generalized Likelihood Test (GLT) and the Edge Vector Test (EVT) . They 
are compared with regard to: 

(1) The systems of parity equations required for FDI. 

(2) The ability to correctly detect and isolate failures. 

(3) The possible thresholds and failure-detection levels. 

(4) The need for dynamic thresholds. 

(5) The development and evaluation of techniques for 

generating these thresholds. 

(6) The software requirements. 

A deterministic digital computer simulation was used to ccxnpare 
and evaluate the algorithms and FDI systems. The evaluation trajectory 
used incorporates features typical of a transport aircraft flight pro- 
file. Time histories of variables pertinent to the evaluation of the 
algorithms were taken. 

The report has the following general outline. A description of 
the redundant sensor configuration is presented first. This is followed 
by a general description of material used in the evaluation of the algo- 
rithms, such as the simulation, instrument models, evaluation trajectory, 
philosophy of FDI, and approach to generating the thresholds. An anal- 
ysis of the two algorithms — EVT and GLT — follows, and a comparison of the 
advantages and disadvantages of the algorithms is made. 

The measurements reported in SI units were originally made in 
English units and translated; the original units are given throughout the 
report in parentheses. 
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SECTION 2 


THE SENSOR CONFIGURATION 


( 1 ) * 

The inertial measurement unit (IMU) is a redundant strap- 

down package employing four two-degree-of-freedom (TDOF) gyros 
(accelerometers) in a semi-octahedral geometry. The instruments are 
positioned such that the spin (pendulous) axes are normal to the four 
faces of the semi-octahedron and point out. The two measurement axes 
of the gyro lie in the plane of the face and are symmetric about the 
face centerline. The IMU consists of two separate packages (faces 1 
and 2, faces 3 and 4) which may be spatially separated along a track 
in the y^ direction. ThuS/ it may be treated as two tetradic IMUs. 

It has been demonstrated that FDI will be more effective if the 
two tetradic IMUs are treated as a single IMU, and that approach is 
taken here. (The effects of a large separation have not been addressed 
in this work.) 

Two axes systems are defined: the body frame (B) and the IMU 

frame (M) , as shown in Figures 1 and 2. The body frame is the conven- 
tional x„ (roll) , y„ (pitch) , z (yaw) axes system. The IMU frame is 
a triad, with x along the track separating the two tetrads and positive 
toward the right wing and y^^ along the junction of IMUs 1 and 2, par- 
allel to the vehicle centerline, and positive forward; completes the 
triad. 


*Superscript numerals refer to similarly numbered items in the List of 
References. 
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Figure 1. Body-axes system definition 




Neglecting any mounting misalignments of the IMU, the rotation 
from the body frame to the IMU frame may be represented by the matrix. 



For an ideal system, with all misalignments identically zero, 
the spin axes and pendulous axes are coincident with the outer normals 
to the octahedron faces, as indicated in Figure 2. 

The matrix defines the nominal transformation from the IMU 
frame z^) to the nonorthogonal spin axes (S^, --w S^) 



The transformation from the IMU frame to the pendulous axes, is 

M 

defined by 


Postmultiplying by H yields 

B 
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and similarly for H . Considering the octahedron as two IMUs, the spin 

B 

(pendulous) axes of IMUs 1 and 2 are represented by the top and bottom 
halves of these matrices, respectively. Figure 3 also indicates this 
separation. 



nonorthogonal sensor axes •••/ B^) may also be written as 


-/J - 1 /J - 1 -2 


^1 

/J-l -/J-l -2 


®1 

/3 - 1 /3 + 1 -2 


^2 

-/3 - 1 -/I +1 -2 


®2 

/J + 1 -/3 + 1 -2 


^3 

-/J +1 /I + 1 -2 


®3 

-/3 + 1 -/I - 1 -2 


^4 

/J + 1 /J - 1 -2 


_®4_ 


6 



2 O 


with the accelerometer measurement axes given by 


"A _ ;g 

"m = "m 


Again, IMUs 1 and 2 are represented by the top and bottom halves of 
, respectively. The transformation from the body frame to the sen 
sor axes is given by 
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SECTION 3 


SIMULATION FEATURES AND INPUTS 


The results of this study were obtained from a deterministic 
digital simulation. A block diagram of this simulation is presented 
in Figure 4 (References 2 and 3 should be consulted for a detailed 


PROFILE 

GENERATOR 


PILOT 

INPUTS 



I FLIGHT COMPUTER 


n 


STRAPDOWN 

LOCAL-VERTICAL- 

WANDER-AZIMUTH 

NAVIGATION 

ALGORITHM 


L_ _ ij 


Figure 4. Simulation block diagram. 
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description of its components) • The core of the simulation is a six- 
degree-of-f reedom aircraft model with nonlinear aerodynamics. Also 
modeled are a flight-control system and turbulence. An autopilot 
"commands” the vehicle to follow a desired trajectory profile. Skewed 
gyro and accelerometer sensor configurations are modeled with the 
location of the sensors variable to permit an assessment of accelerom- 
eter lever-arm effects. The sensors are assumed to be of navigation 
quality and used for navigation and flight-control purposes. The FDI 
algorithm operates on the sensor data to generate the input signals 
to the flight-control and navigation systems. Navigation accuracy is 
assessed by differencing the outputs of a strapdown local-vertical- 
wander-azimuth navigation system model and the vehicle states. 
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SECTION 4 


INSTRUMENT MODELS AND FAILURE MODES 


(2 3 ) 

The instrument models contained in the simulation ’ are generic 
in nature, with their parameters selected to provide a state-of-the-art 
level of performance. The TDOF gyro models include the effects of mis- 
alignment, bias, quantization, g, gxg, ojxoj and scale-factor errors, and 
a lag. The accelerometer models include errors due to misalignment, 
lag, bias, input-pendulous-axis cross-coupling, quantization, and scale- 

factor linear and nonlinear effects. Tables 1 and 2 give the nominal 

(4) 

set of sensor parameters. The sensor error parameters are assumed 
to be Gaussian distributed zero-mean random variables with la values 
equal to their nominal values. Block diagrams of the sensor models are 
shown in Figures 5, 6, and 7 to illustrate the computations performed, 
errors included, and the information flow. Only one axis of the TDOF 
gyro is shown in Figures 6 and 7. A similar expression holds for the 
other axis; the same TDOF error effects are applicable to both axes. 

A further assumption is made regarding the error parameters of the TDOF 
instruments used in this study. Based on the data presented in Refer- 
ence 4, it is assumed that 6 =6 =0.0. This assiamption can 

^j2 ^j3 

be modified to reflect the values of the actual instruments to be im- 
plemented in the IMU. 

Failure modes of TDOF instruments may be either single-degree-of- 
freedom (SDOF) or TDOF in nature. An SDOF failure may be caused by any 
part of the rebalance loop on a given axis (including software) . The 
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Table 1. Two-degree-of- freedom gyro nominal parameters. 



Table 2. Accelerometer nominal parameters. 
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Figure 5. Accelerometer model. 
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Figure 6. Gyro model. 
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Figure 7. TDOF gyro errors. 












high degree of correlation or coupling between the axes, caused by the 
common wheel or pendulum, will propagate the failure into the second 
axis in a short time. Therefore, when a failure is isolated, an entire 
sensor is removed, regardless of the character of the failure. 

Experience with dry TDOF instr\ament9 as a class indicates that 
small performance shifts (such as bias changes turn-on to turn-on) are 
the rule. Parameter shifts of larger magnitude are found only as catas- 
trophic failures (such as wheel bearing or rebalance-loop failures) . 

Such failures, then, will be on the same order of magnitude as the in- 
puts . 
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SECTION 5 


EVALUATION TRAJECTORY 


Figure 8 shows the 1-hour flight profile used to evaluate the 
fault-tolerant system during the dynamic phases of the vehicle flight. 
The profile includes features from a typical transport aircraft mission 
profile: a climb to altitude, cruise, heading changes, descent, and a 

loiter maneuver. Table 3 gives the details of the evaluation flight 
trajectory. 


90° HEADING 
CHANGE 



Figure 8. Evaluation trajectory profile. 
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Table 3. Evaluation trajectory description. 


Time 

(s) 

Event 

Altitude 

(m) 

Mach 

Number 

0 - 100 

Cruise 

1,524 

0.5 



(5,000 ft) 


100 - 617 

Ascent 



617 - 1,000 

Cruise 

6,477 

0.653 



(21,250 ft) 


1,000 - 1,090 

90® heading chcinge 



1,090 - 1,500 

Cruise 

6,477 

0.653 



(21,250 ft) 


1,500 - 1,510 

10° heading change 



1,510 - 2,000 

Cruise 

6,477 

0.653 

1 


(21,250 ft) 


2,000 - 2,010 

10° heading change 



2,010 - 2,200 

Cruise 

6,477 

0.653 



(21,250 ft) 


2,200 - 2,717 

Descent 



2,717 - 2,900 

Cruise 

1,524 

0.5 



(5,000 ft) 


2,900 - 3,340 

Loiter; one 360° turn 



3,340 - 3,600 

Cruise 

1,524 

0.5 



(5,000 ft) 



The vehicle responses, as well as other system responses obtained 
from the simulation using this trajectory, are presented in Figure 9 to 
give an indication of how well the vehicle follows the commanded trajec- 
tory and to show the magnitude of important rates and accelerations 
obtained during the course of the mission. The trajectory commands are 
also presented in this figure, as are the north and east ground veloci- 
ties and latitude and longitude of the vehicle during the trajectory, A 
nominal gust intensity of 1.83 meters (6 feet) per second was selected. 
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As indicated in Figure 9, the vehicle is initially trinuned at an 
altitude (h) of 1,524 meters (5,000 feet) and speed of mach (M) = 0.5. 
After a 100-second cruise at this flight condition, the vehicle begins to 
climb and continues climbing for 517 seconds until it reaches an altitude 
of 6,477 meters (21,250 feet) and a speed of M = 0.65. The flight-path 
angle of the vehicle is 3 degrees and the rate of ascent 609.6 meters 
(2,000 feet) per minute. The vehicle then cruises until 1,000 seconds 
into the mission, at which time a heading change of 90 degrees is 
commanded. The vehicle banks at 20 degrees, its nominal roll rate is 
4.4 degrees per second, and its turn rate is approximately 1 degree per 
second. Another period of cruising flight follows which is interrupted 
by two 10-degree heading changes: one at 1,500 seconds and one at 2,000 

seconds. The vehicle's bank angle, roll rate, and turn rate are the same 
as for the 90-degree heading change. At 2,200 seconds, the vehicle 
begins a descent to an altitude of 1,524 meters (5,000 feet) and M = 0.5. 
The rate of descent is 609.6 meters (2,000 feet) per minute, and the 
flight-path angle is -3 degrees. The vehicle then cruises at this flight 
condition until 2,900 seconds, at which time one 360-degree turn is 
commanded to simulate a loiter maneuver. Significant vehicle parameters 
during the loiter are: a bank angle of 20 degrees, a roll rate of 

approximately 4 degrees per second, and a turn rate of 0.75 degree per 
second. At the end of the loiter, the vehicle cruises to complete the 
1-hour tra j ec tory . 

The navigation errors obtained with a randomly selected set of 
sensor errors for the redundant IMU are also presented in Figure 9. The 
position errors are in the 1.85- to 3.70-kilometer- (1- to 2-nautical- 
mile-) range, while the velocity errors are less than 2.29 meters 
(7.5 feet) per second. 
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SECTION 6 


THE FDI SYSTEM 


Figure 10^^^ is a block diagram of the baseline FDI system. The 
system shown here is mechanized to detect and isolate three levels of 
failure: 

(1) Hard failures: those of a comparatively large magnitude, 

which primarily affect flight-control performance. 

(2) Midvalue failures: those of medium magnitude, which 

affect pilot display performance. 

(3) Soft failures: those of a comparatively small magnitude, 

which affect navigation performance. 

The major emphasis of this study was on the detection and isolation of 
soft failures. Bui It- in- test-equipment (BITE) processing was not consi- 
dered during this study, but indications are that it will be necessary to 
detect simultaneous multiple failures. 

The detection and isolation of sensor failures is accomplished by 
processing the sensor outputs via a set of parity equations. The parity 
equations are linear, constant-coefficient equations selected to remove 
from the data the effect of the quantity which the sensors are measuring. 
That is, the angular-rate information is removed from the gyro outputs 
and the acceleration information is removed from the accelerometer 
outputs. Only the effects of the uncertainties associated with the 
sensors remain as parity-equation residuals. The parity-equation resi- 
duals are then used to ascertain the presence or absence of a failure. 
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Two techniques are explored in this study for detecting the presence of 
a failure: the Edge Vector Test (EVT) and the Generalized Likelihood 

Test (GLT) • 


SENSOR DATA 



Figure 10- FDI algorithm block diagram. 

The par ity^eguat ion residuals are a function of the sensor errors, 
sensor noise, etc., and the effect of the aircraft flight environment on 
these uncertainties. When there is no failed sensor present, these 
uncertainties define a baseline of FDI system operation. When a sensor 
failure occurs, the value and statistics of the parity-equation residuals 
change to reflect the presence of this failure. For example, a large 
bias failure causes a step increase in the parity-equation residuals at 
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the time of the sensor failure. A failure is detected when the parity- 
equation residuals or a function of them exceeds a certain threshold. The 
selection of the proper thresholds is a significant part of the design of 
an FDI system. The basic problem is to select thresholds which allow the 
detection and isolation of the smallest possible failures, ensuring the 
best possible system performance while minimizing the probability of the 
false detection of sensor failures due to sensor noise, quantization, etc. 
Furthermore, the effects of the vehicle trajectory and the maneuvers 
associated with it may require dynamic failure-detection thresholds since 
the nominal values of the FDI system parity-equation residuals are larger 
when the vehicle undergoes dynamic maneuvers. 

Because they are of a large magnitude, hard failures are detected 
using the raw sensor data and parity— equation residuals. A hard— failed 
sensor must be removed immediately from the system to ensure a safe 
flight. As the presence of less significant failures may be masked in the 
raw sensor data or parity-equation residuals by the nominal sensor errors 
and, in particular, by high-frequency sensor noise, quantization, etc., 
the parity-equation residuals are low-pass filtered to increase the ratio 
of the sensor failure effect to the sensor noise and quantization effects. 
For the mid- and soft-failure channels, the detection and isolation of a 
failure is achieved in the same manner as with the hard-failure channel, 
except that the filtered parity-equation residuals are used. 

To detect moderate or midvalue failures, a first-order lag with a 
fairly fast response is used. These failures are also of a large enough 
magnitude that it is desirable to remove them as quickly as possible so 
that system performance is not compromised. Heavier filtering, to 
decrease the sensor background noise level even further, is used to 
detect the smaller soft failures, as they can be tolerated for a longer 
time before major disturbances to system performance show up. For the 
baseline FDI system, the filter associated with the midvalue-failure 
channel is a first-order lag with a time constant of 0.434 second (rise 
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time to 90-percent response, = 1.0 second). The filter associated 

with the soft-failure channel is a second-order system (two first-order 

lags in series) with T = 15 seconds. No significant benefits are 

(9 10 ) 

gained from the use of filters beyond second order. 

FDI of the hard failures is performed at the sensor computation 
rate, i,e. , 50 Hz in this case. This is done so that the output data 
from a hard-failed sensor can be disregarded before it can affect the 
controllability of the air vehicle. The sampling rate for the mid- and 
soft-failure channels can be done at a lower rate since the flight 
controllability of the vehicle is not an issue for failures of these 
magnitudes. The actual sampling rates used are not especially critical, 
and the only requirement is that they be fast enough to be consistent 
with the desired system performance; the mid-failure-channel sampling 
rate should be faster than that of the soft-failure channel because 
larger failures are being detected. Rates of 25 and 2 Hz were used for 
the mid- and soft- failure channels, respectively. 

It should be emphasized that because of the TDOF instruments in 
this system, when a failure is isolated an entire sensor is removed even 
if only a single-axis failure is detected. This ensures that the second 
axis of a sensor, whose performance is highly correlated with the other 
axis, will not degrade system performance. 
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SECTION 7 


THRESHOLD SELECTION 


The technique used to deal with the problem of detecting faults at 
acceptably low levels, while accommodating the effects of maneuvering 
flight, was to implement thresholds composed of both constant and dynamic 
quantities. The constant portion was included to account for the effects 
of quantization and sensor noise during straight and level flight, while 
the dynamic portion accounts for the effects due to maneuvering flight. 

The approach implemented for computing the dynamic FDI thresholds 
analytically duplicates the calculation of the failure-decision functions 
using a derived expression for the upper bound of the sensor errors and 
parity-equation residuals. Figure 11 illustrates the procedure. Quanti- 
zation effects and sensor noise are neglected as they are not easily 



Figure 11. Confutation of dynamic thresholds. 
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defined analytically and they are accounted for with the constant portion 
of the threshold function. Furthermore, the filtering of the parity- 
equation residuals attenuates the effects of quantization and sensor noise, 
and the sensor error effects predominate during dynamic flight phases. 

The derived expression used for the upper bound of the sensor 
errors and parity-equation residuals is a function of the sensor error 
model, the magnitude of the sensor errors, and the body-axes linear 
accelerations and angular rates. The 3a values of the sensor errors can 
be used to develop a system suitable for operation with most sensors of 
the type to be included in this system. However, these values can be 
adjusted to achieve desired probabilities of false-alarm detection, etc. 

The last-pass values of the body-axes linear accelerations or angular 
rates calculated for the flight-control system are used in the generation 
of the dynamic thresholds. 

The angular rates and linear accelerations are filtered before 
computation of the maximum sensor error and parity-equation residual for 
the mid- and soft-failure channels. This reduces the noise level of the 
signals caused by turbulence, sensor noise, etc., and results in accept- 
able threshold levels for the detection of soft failures. Strictly 
speaking, the sensor outputs should be filtered before the parity equa- 
tions are solved. However, the parity equations are linear, and the 
solution of the parity equations and the filtering operations are inter- 
changeable. It is more efficient to filter the parity-equation residuals 
since fewer filters are required. 
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SECTION 8 


THE EDGE VECTOR TEST (EVT) 


8 . 1 Derivation 

The parity equations and EDI algorithm for the redundant IMU are 
^srived in this section using an edge equation formulation. This formu~ 
lation is based on the projection of rates (or accelerations) measured 
in two planes along the line of intersection of the planes. As the 
measurement planes are orthogonal to the spin (or pendulous) axes, the 
"edge vectors" are defined by the line mutually perpendicular to these 
axes. For measurement planes i,j (j > i) 


e. . = UNIT (S. X s .) = 

ID 1 D 


S . X s . 


S. X s . 

' 1 D 


For the geometry shown in Figure 2, e. . may be tabulated as 
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where the e^^ are in body-frame coordinates. 
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Rates (accelerations) measured in the i and j planes may be com- 
pared if they are expressed in a common frame. The frame chosen here is, 
again, the body frame. Then the residual may be expressed by 


^ ,-B -B, -B 

R.. = (w.-oj.)*e., 

i: 1 3 13 


( 1 ) 


If '^ij' ^ threshold, then a miscompare flag, F. ., is set. 

FDI consists of logical operations on the flags F 

ij 

• ^ B 

Equation (1) is written in terms of oi . , the measurement vector 

th ^ 

from the i plane transformed into body coordinates. In response to 

^ B th 

a body rate (specific force) 03 , the i measurement in the gyro frame 

B 

will be 
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where are the corresponding rows of the matrix H*^, and the L' s are 

®ik B 

uncertainties in the measurements, i.e., noise, sensor-error effects, 

failure effects, etc. Independence of the components of ^ may not be 
assumed because of the high correlation of the failure modes of TDOF 
instruments. 

-G . 

IS expressed in body coordinates by 


-B 

0 ) . 
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where, again, = ^'"^il' ^i2' '^il' ^i2 compensated A9 or 

AV measurements in the i^^ plane. 
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For example, consider the i,j = 1,2 measurement pair. In response 
B T 

to an input o) = [co , u) , u) ] , we find 
B X y 2 
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where 

a = + 1 

b = /3 - 1 

E. . = 2/3 . 
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Given the measurements in the coordinates of their re- 

spective frames, the data are transformed to the common body frame by 
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and 
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Then 
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independent of to^, the input; it is a function of only the uncom- 
pensated errors in the measurements. This is true in general for R 

ij 

Each of the six residuals j > i/ represents a comparison of 

two instr\jments. If an instrument fails, the uncertainty vector asso- 
ciated with it has a nonzero bias and all residuals R_ involving that 
instrument will be affected; any residual not involving that instrument 
will be unaffected. This provides a basis for a single-trial failure- 
isolation technique. Only n-3 or 5 independent parity equations exist 
for the redundant sensor configuration considered in this study. 
Therefore, one of the six parity equations is a linear combination of 
the other five. 


Assume a failure-isolation threshold, T, such that residuals ex- 
ceeding T are deemed to represent failed instruments. Logical variables 
can be defined which indicate a pass (false) or fail (true) of a single 
paired comparison between the parity-equation residual and the threshold 
Thus 
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R, . 


> T F. . 

ID 


true 


Logical operations over F. . then isolate the failure. 

ID 

In a practical application, the six parity equations are solved at 
the computation rate of the appropriate FDI channel. If fewer than two 
of the residuals exceed the threshold, failure isolation is not performed. 
This reduces the computational burden of the FDI system. 

Consider instrument 1. Construct the logical equation 

G = (F and F ) or (F and F ) or (F and F. .) 
i 12 13 12 14 13 14 

If instrument 1 fails such that all of the residuals involving it exceed 
the threshold, all F^^ are true and is true. A similar equation for 
another instrument, say instrument 2, will be logically false, e.g. 

S = ^23’ ^^2 ^24^ ^^23 ^34^ 

= (1 • 0 ) + (1 • 0 ) + (0 • 0 ) 

= 0 (false) 


The complete set of logical equations for four instruments is 


G = fF +FF +FF 
1 12 13 12 14 13 14 


G = FF +FF +FF 
2 12 23 12 '' 24 23 24 


G = FF +FF +FF 
3 13 23 13 34 23 34 


G = FF +FF +FF 
4 14 24 14 34 24 34 
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To isolate a second failure, given instrument i has failed 


G . 


F F 
jk j£ 


where i, j, k, £ is a cyclic permutation of 1, 2, 3, 4. That is 


Instrument 1 Instrument 2 Instrument 3 Instrument 4 
Failed Failed Failed Failed 


°2 ''23*'24 '^1 '’l3'’l4 ''l2''l4 *^1 ''l2'’l3 


S ' ''23*'34 =3 = ''l3''34 =2 ' ''l2'’24 =2 = '’l2''23 


G=FF G=FF G=FP r;=FF 

4 ^ 24 34 ""4 14 34 ^4 14 24 ^3 13 23 


A third failure, given i,j failed, may be detected by noting that F^^^ is 
true, or that instruments k and £ miscompare. 

The actual parity equations implemented in the simulation are in 
terms of the body-axes components of the sensed quantities. Thus, for 
the gyros the body-axes components of the sensed angular rates are 
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B 

= -0.211325m + 0.788675m 
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and the complete set of parity-equation residuals is 
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A similar set of equations holds for the accelerometers, 
substitutions. 


( 2 ) 

(Cont . ) 


(3) 

with appropriate 
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8.2 FDI Sensitivity 

The orientation of the sensors with respect to the vehicle body 
axes and the resulting system of parity equations have a profound effect 
on the magnitude of sensor failures which can be detected and isolated. 
This aspect of the FDI problem for the redundant IMU sensor configura- 
tion and the EVT is explored in this section. SDOF instrument failures 
are assumed because it simplifies the discussion and gives insight into 
the area of FDI sensitivity, and because failure modes of this nature 
are a distinct possibility with TDOF gyros. 

The parity equations attenuate the effect of a sensor failure, thus 
reducing its magnitude in the parity-equation residuals. The degree to 
which this occurs for the EVT algorithm is shown in Table 4, which gives 
the factor by which each of the sensor outputs is attenuated for all pos- 
sible sensor configurations and failures. Thus, for example, the effect 
of a failure in instrument axis Bl will be attenuated by 0.258819 in 
parity equation -0.707107 in parity equation R^^, and 0.965926 in 

parity equation R^^ for the four- instrument configuration. These are 
only three parity equations affected by the failure of this instrxmient 
axis. Table 4 was generated by substituting the equations for the com- 
ponents of the edge vectors into the parity equations. Uniform detecti- 
bility of the first failure exists with this algorithm since all of the 
coefficients of Table 4 obtained for it are permutations of each other. 

The effect of the attenuation of the sensor outputs by the parity 
equations on the ability to detect and isolate failures is now considered. 
Consider the case with four instruments and an Al axis failure with magni- 
tude f. The effect on R will be 0.965926f, on R will be 0.707107f, 

X Z X j 

and on will be 0.258819f. Axis Al will be declared failed if both 

1 ^ 12 ! 1 ^ 13 ! greater than T. Therefore, the minimum value of 

failure detected will be f = T/0. 707107 = 1.414214T. 

The ability to detect failures degrades for the second and third 
failures; in certain instances, the magnitude of failure detected can 
be f = T/0. 258819 = 3.863704T. This occurs when detection of a failure 
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Table 4. EVT algorithm FDI sensitivity; coefficients of parity 
equations. 


Failed 

Sensors 
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Axis 


Parity-Equation Residual 
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in instrument axis B2 is attempted after sensor 1 has failed and has 
been removed from the cluster. Table 4 illustrates the degree to which 
all of the possible sensor configurations are affected by the attenua- 
tion of the sensor failures due to the parity equations. 

Table 4 can also be used to provide qualitative information use- 
ful in distinguishing the wrong isolation of failures when the EVT is 
employed. This can be illustrated as follows. First, assume that a 
first failure is being detected and isolated. Then, assvime that the 
A1 sensor axis fails with a magnitude just large enough so that the 
parity-equation residual ®^ceeds the threshold. If the failure 

is large enough so that exceeds the threshold, the A1 axes will 

be declared to have failed and instrument 1 will be removed from the 
cluster. However, if |r^^| does not exceed the threshold, the possi- 
bility for false isolation exists since the sensitivity coefficient 
associated with the parity-equation residual 1 ^ 23 ! ^ failure in 

axis A2 is 0.965926. In a high-noise environment with low failure- 
detection thresholds, it is possible for 1 ^ 23 1 exceed the threshold, 
and A2 will be selected as the failure axis rather than Al. Other 
sensor configurations that are prone to the wrong isolation of sensor 
failures can be determined from Table 4 in the same fashion. 

8.3 FDI Thresholds 

The generation of the thresholds for the TDOF gyros is considered 
first. An analytic expression for the output of the jth TDOF gyro is 
required to implement the approach defined in Section 7. This expres- 
sion may be obtained from a consideration of Figures 6 and 7. The ef- 
fects of qviantization and rectangular integration are neglected and 
only first-order error terms are retained. The effects of the filtering 
required for the mid— and soft-failure channels are not considered at 
this point in the discussion. The resultant analytic expression for 
the output of the jth TDOF gyro is 
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where 
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(Cont. ) 


j = first input axis of instrument 
= 1(A1) , 3(A2) , 5 (A3) , 7(A4) 

k = second input axis of instrument 
= 2(B1) , 4 (B2) , 6(B3) , 8(B4) 




^j2 


When Eq. (4) is svibstituted into the parity equations, the 

. G 

p, and H • r terms disappear. The parity-equation residuals 
®j3 


are then a function of the sensor error terms only. An analytic expres- 
sion for the bound of the sensor errors is needed to generate dynamic 
thresholds for the parity-equation residuals. This expression may be 


obtained by assuming worst-case conditions: 
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matrices are such that all terms add; a bound for the svms of these 


the siqns of p, q, r and the elements of the gecanetry 
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terms is given by the sum of their absolute values; and the sensor 
errors are additive and bounded by their 3a values* These assumptions 
lead to the following expression for an upper bound of the TDOF gyro 
errors 



By comparing this expression to Eq. (4) , it is evident the 6 


IS an 




upper bound for 5 +5 t 6 ,6 is an upper bound for 5 + 

^jl ^j3 ^nm ^j4 

5 +6 +6 +6 , and 6 is an upper bound for 6 +6 

^j6 ^j7 ^j8 ^j9 "m "j8 "j9 

Equation (5) is now used to generate an analytic expression for 

the upper bound of the parity-equation residuals. This is done by noting 

that the maximum value of the body-axes components of the sensed angular 

rates, given by Eq. (2) , is 
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Furthermore, the upper bound of the parity-equation residual is given by 
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The final expression for the thresholds for the gyro parity equation for 
the hard- failure channel is 


T 


g 


h 


+ 3 . 266 m 


"Oh 


m 


( 6 ) 


since only the sensor error terms remain. T is the constant portion 

^Oh 

of the threshold, which accounts for quantization, sensor noise, etc. 

The absolute value of the parity-equation residual is compared 
to the output of Eq. (6) to ascertain whether a failure has occurred. 
Under normal operating conditions, with unfailed sensors present in 
the system, this threshold will not be exceeded. The dynamic portion 
of the failure-detection threshold is generated in real time using the 
last values of the angular rates and linear accelerations generated 
for the flight-control system. 


Equation (6) is valid for the hard-failure channel in which no 


filtering of the signals is done. T is large relative to the dynamic 

^Oh 

portion of the threshold because of the significant effects of quanti- 
zation. Modifications must be made to Eq. (6) for the detection of mid 
and soft failures. In order to make a valid comparison between the 
parity-equation residuals and the thresholds, it is necessary to filter 

each in an identical manner. When the effects of p, q, r and n , n , n 

X y z 

on the sensor errors are linear, these signals can be filtered before the 

expression for the upper bound is derived. Thus, |p^| + |q^| + 

used in lieu of |p| + |q| + |r| in Eq. (6). However, when the effects of 

these quantities are nonlinear, an expression for the upper bound of the 

nonlinear effect must be generated and then filtered. An example of this 
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The expression for the dynamic thresholds can be modified further 
to take advantage of the sensor configuration geometry to lower the mini- 
mum level of failure which can be detected. Consider the soft-failure 
channel. If the filtering is heavy enough so that the effects of quanti- 
zation can be neglected, the constant for the soft-failure-detection 
threshold can be set equal to zero, so that the smallest possible failure 
can be detected. The level of soft failure which can be detected will 
then be governed by the dc value of the dynamic thresholds. The value 

is due in part to \ , but arises mainly from the effect of the normal 

^m 

acceleration level of =-l g encountered dxiring straight and level flight 
on the acceleration-dependent errors, i.e., the 6 In I and 5 

Q 2 

terms of Eq. (5) . For the sensor configuration vmder consideration, the 

terms of the input and spin sensor geometry matrices affecting n are 

G G S ^ 

0.577350 (H , H , and ). Therefore, improved soft- failure- 

®j3 \3 ®jk3 

detection capability can be achieved by using |o.577350n^| in lieu of 
I'^zl analytic expression for the threshold. This has the effect 

of lowering the dc value of the dynamic threshold and therefore the 
level of soft TDOF gyro failure which can be detected. 

Incorporating into Eq. (5) and (6) the conclusions just drawn 
regarding the effect of filtering and sensor geometry on the thresholds 
leads to the following expression for the upper bound of the TDOF gyro 
errors and the failure-detection thresholds 



m 


m. 


= ( 




m mm 


^ '^g (i^fl + l\fl n0-577350n |) 


+ \ + l\l + |0.577350n |)^1 

^nm ^ ^ 


+ 6^ [(|p| + |q| + |r|) 

m 


T^ = T + 3.266 m 

g % g. 


m. 


(7) 

( 8 ) 
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The minimum ideal level of gyro failure which can be detected 

with the EVT algorithm may be obtained from Eq. (7) and (8) • Straight 

and level unaccelerated flight in nonturbulent air is assumed along 

with heavy filtering in the soft-failure-detection channel. These 

assumptions imply that n =n =p=q=r=T =0.0 and n = -1.0 q. 

X y z ^ 

Using the 3o values of the sensor errors leads to T = 0.453 deqree per 

hour. As is shown in Section 8.5, this threshold can be decreased under 
penalty of an increased probability of the false detection of failures. 
The actual value of soft failure which can be detected depends upon 
the value of the failure-detection sensitivity coefficient presented 
in Table 4. The smallest failure detected will be 0.453/0.707107 = 

0.640 degree per hour. 

A similar development has been carried out to determine an ex- 
pression for the accelerometer FDI system thresholds. The jth accelerom- 
eter output is obtained from Figure 5 and is given by 


m 


a . 
3 


(DT • G(<)){H; 




n + 

X 


®j2 


n + 

y 


®j3 


n 

z 


where 


+ A 'n+u ‘n-t-u -n 

^ ^j2 y ^j3 " 

+ e *n -n 

*j\ ®jl * ®j2 y ®j3 V 

+ a /H^ • n +H^ ‘n + H^ 

IPj\ X y B .3 zj 

/ P P P \ 

• (H • n • . n + H ■ n I 

\ ®jl ^ ®j2 y ®j3 V 

+ 3tt • n + • n + V 

®jl " ®j2 y ^j3 V 

j 1/2, ...,8 = Al ,Bl, •«•, B4 
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Performing the same simplifications and steps as in the case of the gyros 
leads to the following expression for the upper bound of the accelerom- 


eter error 


m 

a 


m 


f 


(DT . G4.)|x^ + + |n | + 1 0 . 577350n^ 

\ m \ m mf \ ' 


+ Ib 

- “t. 11 

(In 1 + |n 1 + |0.577350n IP 

J 

H 

H 

3 


^ x' ' y' z'f 



Strictly speaking, since p in the equation for m is not multiplied 

a . a . 

A ^ 

by H" , the misalignment error coefficient used to obtain y must be 
B . a 

j3 m 

divided by 0,577350. This was not done during this study. 

The final expression for the accelerometer threshold is then given 
by 


T = T + 3.266m 
a a a 

0 m^ 

The minimum level of accelerometer threshold attainable for the 
EVT algorithm is 1350 micro-g for straight and level unaccelerated 
flight in nonturbulent air. The smallest actual accelerometer failure 
which can be detected because of the failure-detection sensitivity of 
the algorithm is 1350 micro-g/0 . 707107 = 1909 micro-g. This value may 
be adjusted downward under the penalty of an increased probability of 
false alarm as is discussed in Section 8.5. 

One additional important conclusion can be drawn regarding the 
thresholds determined for the EVT. The thresholds are not a function 
of the number of instruments in the configuration. This means that 
the lower failure-detection sensitivity evident in Table 4 for a con- 
figuration with fewer sensors in the cluster is not compensated for 
by a corresponding lowering of the failure-detection thresholds. 
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8.4 


Simulation Results 


This section presents and discusses the results obtained with 
the simulation described in Section 3 for the EVT algorithm. Presented 
are time histories of the parity-equation residuals and failure-detection 
thresholds obtained using the equations and techniques presented pre- 
viously. Time histories were obtained for two vehicle trajectories: 
the maneuvering trajectory, which is presented in Figure 8, and straight 
and level unaccelerated flight, which was taken to gain a better under- 
standing of the FDI capability of the EVT without the effects of maneuvers. 

Figure 12 shows the value of one of the parity-equation residuals 
obtained. The top half of the figure shows the residual unfiltered, 

lagged with the filter used for the midvalue-failure channel, and passed 
through the second-order filter used for the soft-failure channel. The 
unfiltered parity-equation residual is random in nature due to the effect 
of the sensor quantization. Its peak value is in the vicinity of 258 
degrees per hour. Filtering reduces the magnitude of the parity-equation 
residuals as evidenced by these variables for the mid- and soft-failure 
channels. The magnitude of these signals is indicative of the level of 
sensor failure which can be detected in each of these channels. 

The corresponding parity-equation residuals obtained for the 
maneuvering- flight trajectory are also shown in Figxire 12. The un- 
filtered residual corresponds very closely in character and magnitude 
to that obtained for the maneuvering trajectory. The vehicle maneuvers 
have no apparent effect on this paraimeter. The effect of the maneuvers 
on the lagged midchannel parity-equation residual is also minor at most. 

A slight increase in magnitude at some point in the trajectory occurred 
as evidenced by the change in scale from that obtained for the non- 
maneuvering trajectory. This point, however, does not occur in Figure 12, 
since only the data points at 1-second intervals are plotted, although 
each calculated point is used to set the scale. 

The effect of the vehicle maneuvers is very evident in the soft- 
failure-channel parity-equation residual. The magnitude of the signal 
obtained with the maneuvering trajectory is on the order of four times 
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that obtained for straight and level flight. This dictates the need 
for dynamic failure-detection thresholds. If a constant threshold were 
used, it would have to be large enough to account for the effect of all 
of the possible maneuvers that the vehicle would undergo. This, how- 
ever, would compromise the failure-detection capability of the system 
during straight and level flight since the thresholds would be much 
larger than required. A much more appealing solution is to adopt the 
approach advocated in this report of having thresholds which are con- 
stant during straight and level flight but which also include the terms 
affected by the dynamics of the vehicle so as to account for these effects. 

Typical hard, mid, and soft accelerometer FDI system parity-equation 
residuals are presented in Figure 13 for both the straight and level and 
maneuvering trajectories. The residual is the particular one shown. 

The hard-failure-channel residual is random in nature and of the same 
magnitude for both trajectories. This randomness is of course due to 
quantization. The magnitude of this residual is also quite small, indi- 
cating that the level of hard failure which can be detected will also be 
quite small. 

The soft-failure-channel residuals are constant for nonmaneuvering 
flight. The maneuvers have very little effect on these variables. The 
constant portion arises because of the effect of the 1-g steady-state 
normal acceleration on the sensor errors. This implies that constant 
thresholds may be suitable for the soft-failure-detection channel and 
for the whole accelerometer FDI system. 

The mid-fail\ire-channel parity-equation residuals are just less 
heavily filtered versions of the soft-failure-channel parity-equation 
residuals. They have a slightly larger magnitude because of the higher 
noise level. Since the magnitude of the hard-fai lure-channel parity- 
equation residuals is so small and the soft-failure-channel residuals 
are so much cleaner, the need for a mid-failure channel is not apparent 
for the accelerometers. 

The threshold levels obtained for the EVT algorithm with the 
technique outlined in Section 8.3 are now presented and discussed. 
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The first item that must be addressed is the selection of the constant 
portion of the thresholds included to account for quantization, etc. 
Based upon the data presented in Figures 12 and 13, as well as those 
data obtained for other simulation runs, the constant thresholds given 
in Table 5 were selected. The constant portion of the thresholds for 
the soft-failure channels was set at zero so that the smallest possible 

failures could be detected. 


Table 5. Constant thresholds for the EVT algorithm. 


Instrument 

Channel 

Threshold 

Gyro 

Hard 

227'“ /h 


Mid 

20.63°/h 


Soft 

0.0°/h 

Accelerometer 

Hard 

6019 yg 


Soft 

0.0 yg 


The EVT gyro thresholds are presented in Figure 14 for both maneu- 
vering and nonmaneuvering flight. The hard-failure- and mid-failure- 
channel thresholds are basically the same for both trajectories, with the 
level dictated by the constant portion of the threshold. The effects of 
the maneuvers are not really evident, except for the soft- failure channel 
where the threshold is an order of magnitude larger for the maneuvering 
trajectory than for straight and level flight. The soft-failure-detection 
threshold for level flight is in the vicinity of 0.7 degree per hour. 

This value defines the level of FDI capability which can be expected 
with the EVT, and it is slightly larger than the ideal value mentioned 
in Section 8.3. One of the reasons for this discrepancy is the effect 
of a nonzero steady-state value of n^. This was neglected in arriving 
at the ideal value and accounts for a 10-percent difference. Further- 
more, the vehicle is continually excited by turbulence during the tra- 
jectory, which increases the level of the threshold. During flight in 
nonturbulent air, the level of the soft-failure-detection threshold 


51 




TIME (min) 


Figure 14, TDOF gyro failure -detect ion thresholds; EVT. 
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closely approxiiuates the ideal value. The fact that the minimum level 
of the soft-failure-detection threshold is less than the maximum value 
of the soft-failure-channel parity-equation residual shown in Figure 12 
dictates the need for dynaiuic thresholds- 

The accelerometer thresholds are presented in Figure 15. These 
thresholds reflect the conclusions drawn previously concerning the accel- 
erometer parity-equation residuals. No mid-failure-channel threshold is 
shown. The maneuvers have only a slight impact on the soft- failure- 
detection threshold. The level of the hard-failure-detection threshold 
is quite low, dictated by the sum of the constant value of the thresholds 
given in Table 5 and the soft- failure-detection threshold shown in Fig- 
ure 15 . 


8. 5 Probability of False Alarm 

In this section, a simplified analysis is carried out to arrive 
at an upper bound for the probability of the false detection of the first 
soft sensor failure using the EVT algorithm. This reflects an effort to 
determine the degree to which the nominal value of the sof t-failure- 
detection theshold can be lowered to achieve better navigation-system 
performance without significantly degrading the system because of false 
alarms. Assume that the vehicle is flying straight and level in a low- 
turbulence environment. A simplified expression for the gyro sensor 
error, obtained from Eq. (4), which is valid under these assumptions is 




(0.577350)5 

^jl 


+ 


(0.577350)^(5 +5 +5 +6 + 

\ 5j4 ^j6 ^j7 ^j8 



where n is assumed to be zero-mean Gaussian noise with standard deviation 
a . The sensor errors are assumed to be Gaussian distributed variables 

n‘ 
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with la values equal to the nominal values given in Table 1. This 
leads to the following result 

4 - (” • li?)' W. 000310555 f o^) 

since the variance of the total is equal to the sum of the variances. 

A continued analysis leads to the result that the variance of the errors 
of the body-axes components of the sensed angular rates is 


2 

0) 



and that the variance of the parity-equation residuals is 
2 

g 


The declaration of a false failure requires that two parity- 
equation residuals exceed the threshold simultaneously. There are 12 
ways in which this can occur, as is evident from the FDI equations 
given in Section 8, Since the parity-equation residuals are each 
Gaussian random variables, the probability of two of them exceeding 
a threshold simultaneously is governed by a joint Gaussian probability 
density function. Furthermore, the joint density function is highly 
correlated since noise in one sensor output can affect two parity- 
equation residuals simultaneously. 

Rather than tackling the approach just described, which is very 
complicated, a simplified approach to the problem was pursued and 
an upper bound for the probability of false alarm determined. In 


= 2.0 a. 


^ (0.000330555 + O^) 
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doing this^ it must be realized that the probability of one parity- 
equation residual exceeding the threshold is greater than the probability 
of that residual and any other residual exceeding the threshold. That 
is, P(|r^^| > T) > T and > T) . Since there are 12 ways 

for a false alarm to occur, and the probability of a parity- equation 
residual is the same for each residual, the probability of the false 
detection of the first sensor failure is given by 

P < 12P( |r. . 1 > T) 

The probability of exceeding a given threshold level is obtained 
from a table of Gaussian probability distribution function values. The 
two-sided value must be used since the threshold can be exceeded both 
positively and negatively. 

Figure 16 shows the values of the thresholds obtained as a func- 
tion of the sensor noise level and the ratio of the threshold level to 
the standard deviation of the parity-equation-residual noise. Also 
presented in this figure is the upper bound for the probability of false 
alarm as a function of the ratio T /a„ . The value of the nominal soft- 

^ g 

failure-detection threshold was given in Section 8.3 as 0.453 degree per 
hour. This value is also indicated in Figure 16 so that its probability 
of false alarm can be evaluated. 

A similar analysis has been carried out for the accelerometers. 

The results are presented in Figure 17. 
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THRESHOLD (°/h) 



Figiire 16. Gyro soft-failure-detection thresholds vs. sensor noise 
level and ratio of threshold to nominal parity-equation- 
residual noise level. 
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Figure 17. Accelerometer soft-failure-detection thresholds vs. sensor 
noise level and ratio of threshold to nominal parity- 
equation-residual noise level. 
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SECTION 9 


THE GENERALIZED LIKELIHOOD TEST (GLT) 


9. 1 Description 

The GLT algorithm is briefly described in this section. Consider 
first the hard-failure channel. In the absence of sensor failures, the 
measurement equation is 


m = Ho) + n 


A set of parity equations is defined by 


(9) 


P = Vm (10) 

where 

VH = 0 

V is assumed to be of dimension (n - 3) x n. The matrix V can be chosen 
so that 


W 


I 


Substituting Eq. (9) into Eq. (10) yields 

A 

% ■ 
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In the absence of sensor failures, depends only on the measurement 
noise. If sensor j experiences a bias-type failure of magnitude f, and 
that failure is manifest as an apparent bias shift of magnitude b in 
measurement j, then 


P 


F 


Vn + V . b 
D 


The difference in the statistics of p (in the absence of failures) and 

N 

p (in the presence of failures) provides a basis for detecting and iso- 
lating failures. The problems of detecting and isolating sensor failures 
fall within the general framework of composite hypothesis tests, since 
the sign as well as the magnitude of the bias failure is unknown a priori. 

A GLT formation of the detection and isolation problems has been 
developed. Assume single-axis failures initially. The GLT decision 
functions for detection and isolation are 




T^ 
P P 



( 11 ) 


( 12 ) 


These decision functions are strictly functions of the parity-equation 
residuals, p. The detection decision is made by comparing DF^ (which is 
the sum of the squares of the parity-equation residuals) to a detection 
threshold. A sensor failure results in a change in the mean value of 
a sensor output, the parity-equation residuals, and the failure-detection 
function. The isolation decision is then made by determining max . (DF ). 

^ j 

The value of j that maximizes DF^ identifies the sensor that is most 

j 


likely to have failed. 
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The preceding discussion assiomes a set of n SDOF instruments. 

The extension to TDOF sensors requires certain modifications to reflect 
the characteristics of these instruments. Correlation between the 

noise present in the two measurements derived from a TDOF sensor is 
possible. One approach is to assume no correlation, design the FDI 
algorithms accordingly, and examine the degradation of FDI performance 
which occurs due to the presence of the nonzero values of correlation. 
This approach leads to the simplest algorithms and is preferred when 
the performance penalty incurred for nonzero values of correlation is 
acceptably small. In this case, the detection problem formulation is 
not changed, and the appropriate decision function is given by Eq. (11). 

In formulating the isolation problem, another characteristic of 
TDOF sensors must be considered. A TDOF sensor failure may be reflected 
in either or both of its measurement axes. In practice, a failure ob- 
served in either axis is sufficient to disqualify the data from both of 
the sensor axes. Thus, isolation of a failed sensor rather than of a 
failed axis is sufficient. The isolation problem then involves testing 
only n/2 hypotheses. The GLT decision function for isolation which 
corresponds to Eq. (12) is 

''T " "T" -1 "T" 

DFi = p (V^V J V^p j = 1,2,..., n/2 (13) 

where V. = [v^ . and . are the two columns of the V 

j 2j-l 2j 2j-l 2j 

matrix associated with TDOF sensor j. 

The detection and isolation of the mid and soft failures is ac- 
complished using the same decision functions as for the hard-failure 
channel. The only exception is that the appropriately filtered parity- 
equation residuals are used in lieu of the unfiltered ones. 

The determination of the performance probabilities for the GLT 
algorithm such as the probability of false alarm, missed detection, etc., 
is a complex analytic task. For this reason, it was not carried out 
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under this study for the sensor configuration of interest. A qualitative 
approach was employed instead as discussed in Section 9.2. The analytic 
technique for generating these probabilities is demonstrated in Refer- 
ences 6 and 7 for sensor configurations other than the one discussed here 

9. 2 Parity Equations 

The GLT algorithm requires sets of parity equations with the 
properties defined in Section 9.1. The parity-equation sets are obtained 
via an algorithm specified in Reference 11 using a least-squares approach 
One set of equations is needed for each possible potential sensor con- 
figuration because of the reconfiguration of the sensor cluster follow- 
ing instriament failures. Tables 6 and 7 provide information concerning 
the number of sensors, number of parity-equation sets needed, and equa- 
tions within each set. The sensor configurations to which these sets 

Table 6. GLT parity-equation information. 


Number of 
Instruments 

Instruments 

Number of 
Parity Equations 

4 

1,2, 3,4 

5 

3 

1,2,3 

3 


2,3,4 



3,4,1 



4,1,2 


2 

1,2 

1 


2,3 



3,4 



4,1 


2 

1,3 

1 


2,4 
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Table 7. Parity-equation matrices for GLT algorithm. 


1 0.79056 

0.0 -0.15811 

-0.43197 

0.15811 

-0.31623 

-0.15811 

0.1157'5^ 

r 1 

1 Four Instruments 

I 0.0 

0.79056 0.11575 

-0.15811 

-0. 31623 

0.15811 

-0.43197 

-0.15811 

1 

1 0.0 

0.0 j 0.76590 

-0.06528 

-0.08277 

-0. 53507 

0.19585 

-0.27862 

1 

1 1 1 

1 0.0 

0.0 0.0 

0.63964 

0.16322 

-0.424 51 

-0.58442 

0. 20607 1 

! 1 

1 0.0 

0.0 0.0 

o 

o 

1^.68301 

0.18301 

-0.18301 

-0.68301 1 

1 Two Instruments"! I * 

1^ 

1 

1 




rEjrzjr" 

■ 

1 Adjacent j • | 


Two Instruments-Separated 


0.5 -0.5 0.5 -0.5 


of parity equations apply is also given. Thus, four systems of parity 
equations are needed to detect the first two failures. A single system 
of parity equations is applicable to the four-instrument cluster. A 
single system of parity equations is applicable to all possible sets of 
three-instrument groups since they are rotations of each other. Two 
systems of parity equations are needed for the two-instrument-sensor 
clusters: one when the two instruments are adjacent to each other and 

the other when the instruments are opposite each other. 

Several assumptions have been made in the following discussion 
for purposes of convenience. When the three- instrument configuration is 
considered, it is assumed that the unfailed instruments are 1, 2, and 
3 and that instrument 4 has failed. Similarly, the pairs 1,2 and 1,3 
are used for the two- instrument configurations. All of the other pos- 
sible two- and three-instrument configurations are rotations or per- 
mutations of these and involve just a renumbering of the sensors. 
Assumptions are also made with regard to the particular axis within a 
configuration which fails. The results are applicable to other axes 
as well because of the reordering which can be done. 

The systems of parity equations applicable to the redundant IMU 
considered in this study are presented in Table 7. The set of parity 
equations for the three-instrument configurations and the parity equa- 
tion for the two-adjacent-instrument configurations are subsets of the 
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five parity equations for the four- instrument IMU. The parity equation 
for the case where the two instruments are opposite each other is also 
presented in Table 1 , Because of the symmetry of this configuration, 
the equation is the sum and difference of the instrument measurements 
multiplied by a constant. 

The failure-decision function associated with the GLT algorithm 
is the sum of the squares of the parity-equation residuals (see Eq. (11)). 
A measure of the ability of this algorithm to detect failures is given 
by the square root of the sum of the squares of the coefficients of the 
columns of the parity-equation matrix. The failure-decision function 
is the square of the just-mentioned number times the magnitude of the 
failures squared (for perfect instruments). Thus, the smaller the value 
of this number, the greater the magnitude of a detectable failure re- 
quired for a given value of failure-detection threshold. 

The values of the failure-detection sensitivity coefficients or 
square root of the sum of the squares of the elements of a column of 
the parity-equation matrix are presented in Table 8 for the redundant 
IMU. From the information contained in this table, it is evident that 
the first failure is uniformly detectable because of the symmetry of 

Table 8. GLT failure-detection sensitivity. 


Number of 
Instruments 

Failed Axis 

A1 

B1 

A2 

B2 

A3 

B3 

A4 

B4 

4 

0. 7906 

0. 7906 

0. 7906 

0. 7906 

0.7906 

0. 7906 

0. 7906 

0. 7906 

3 

0.7659 

0.6430 

0.7071 

0. 7071 

0.6430 

0.7659 

- 

- 

2 (adjacent) 

0.6830 

0.1830 

0.1830 

0.6830 

- 

- 

- 

- 

2 (separated) 

0.5 

0.5 


- 

0. 5 

0.5 

- 

- 


64 



















the instrument cluster. The columns of the V matrix satisfy the uniform 
detectability constraint 




V .V . 

J J 


n - 3 


n 


j 


1/2/a . • /n 


The failures associated with the three-instrument clusters are also fairly 
uniformly detectable, although the magnitude of failure which can go 
undetected is larger for three instruments than it is for four. When 
failure detection for the two- instrument clusters is considered, it is 
once again evident that a failure larger than that needed in the three- 
or four- instrument cases has to occur before it is detected. In the 
majority of cases, the magnitude of failure which will be detected is 
approximately the same. The only case where a disparity exists is when 
it is necessary to detect a failure in the two inner axes when two ad- 
jacent sensors remain. In this instance, the failure must be 4.3202 
times larger than the failure magnitude detected for the first failure. 

The GLT failure-isolation decision function is given by Eq. (12) 
for single-axis failures and by Eq. (13) for TDOF failures. The failed 
sensor is chosen to be the one corresponding to the largest failure- 
isolation coefficient. The incorrect isolation of a sensor failure arises 
from the presence of sensor noise, which could cause the isolation co- 
efficient corresponding to a sensor axis other than the failed one to be 
largest. 

The GLT algorithm failure-isolation sensitivity may be examined 
by comparing the normalized magnitudes of the failure-isolation coeffi- 
cients for different failed- instrument axes. A measure of the ability of 
the GLT algorithm to isolate failures correctly and not to select the 
wrong sensor as having failed is given by the ratio of the largest isola- 
tion coefficients for a given failure. 
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The values of the failure-isolation coefficients obtained for the 
redundant IMU configuration with the GLT algorithm are presented in 
Table 9 for the four-instrument and three-instrument sensor configurations. 
It is only possible to detect (not isolate) a failure with two instru- 
ments, so the two-instrument case was not considered; single-axis fail- 
ures are assumed, A similar exercise could be carried out for dual-axis 
failures via Eq. (13) , but this has not been done so that a comparison 
could be drawn with the corresponding material in Section 9. 

Table 9. GLT failure-isolation coefficients for single-axis failure. 


Coefficient 

of 

I solation 

Failed Axis 

Four 

Instruments 

Three Instruments 

Function 

A1 

A1 

B1 

A2 

B2 

A3 

B3 

A1 

0.625 

0. 587 

0.004 

0.007 

0. 286 

0.038 

0,007 

B1 

o 

o 

0.006 

0.413 

0. 029 

0.135 

0. 362 

0.054 

A2 

0.025 

0.008 

0.0241 

0.500 

0.020 

0.112 

0. 336 

B2 

0.1866 

0.336 

0.112 

0.020 

0. 500 

0.0241 

0.008 

A3 

0.025 

0.054 

0. 362 

0.135 

0.029 

0.413 

0. 006 

B3 

0.100 

0.077 

0.038 

0. 286 

0.007 

0.004 

0. 587 

A4 

0.025 

- 

- 

- 

- 

- 

1 - 

B4 

0.013 

- 

- 

- 

- 

- 

- 


The ability to correctly isolate the first axis failure for the 
four-instrument configuration should be quite good since the ratio of 
the second largest isolation coefficient to the largest is 0.2986. How- 
ever, the ability to correctly isolate failures is degraded for the 
three-sensor configuration. For example, difficulties may arise, in- 
correctly isolating axis B1 as having failed since the ratio of the 
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isolation coefficient for axis A3 to that of axis B1 is 0.8765. Axis 
A3 may be falsely chosen as the failed instrument axis in a noisy en- 
vironment. Other potential difficulties in isolation which may arise 
are between axes A1 and B2 when axis A1 has failed and between axis A2 
and B3 when axis A2 has failed. The same difficulty also arises if the 
other sensor fails in the previous cases. 

9. 3 FDI Thresholds 

The thresholds used with the GLT algorithm are generated using 
a method very similar to that used for the EVT algorithm. They also 
consist of a constant portion and a dynamic portion. The dynamic 
thresholds are again generated from an analytic expression for the upper 
bound of the sensor errors and parity-equation residuals. However, the 
failure-decision function is different for the two algorithms and this 
is reflected in the generation of the dynamic thresholds. For the EVT 
algorithm, the parity-equation residuals are compared directly to the 
thresholds for failure detection. With the GLT algorithm, the failure- 
decision function is the sum of the squares of the parity-equation 
residuals. 

Consider the development of the thresholds for the TDOF gyros. 
Equation (7) is still valid for the upper bound of the TDOF gyro errors. 
The parity-equation residuals are given by 


n 



The residuals are a function of the sensor errors only because of the 
manner in which the V matrix was selected. 
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An upper bound for p 


IS 




The failure-decision function is 


n-3 




Therefore, an upper bound for DF 

D 


g 


is given by 


T 

g 



(14) 


The constant portion of the threshold is added to this when it is neces- 
sary to account for quantization and sensor noise as in the hard-failure 
channel . 

A similar expression results for the accelerometer thresholds, 
except that m is used instead of m 

One significant conclusion which can be drawn regarding the GLT 
thresholds is that they are a function of the number of parity equations. 
Thus, when fewer sensors are present, fewer parity equations are required, 
and the thresholds can be lowered to compensate for the lower failure- 
detection sensitivity which occurs when this happens. 
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The minimum level of failure which can be detected with the GLT 
algorithm can be determined from Eq. (14) to provide a comparison with 
the value obtained for the EVT algorithm* Under the assumptions of 
straight and level flight, etc., the nominal thresholds obtained for the 
GLT algorithm are 


T = (0.660°/h)^ 

T = (1967 ug)^ 

a 

s 

The actual values of the first failure detected are obtained by modify- 
ing these values by the failure-detection sensitivity. These values are 
0-835 degree per hour for the gyros and 2488 micro-g for the accelerom- 
eters. 

9. 4 Simulation Results 

The failure-decision functions obtained with the GLT algorithm 
for both the nonmaneuvering and maneuvering trajectories are presented 
in Figure 18 for the gyros and Figure 19 for the accelerometers. The 
conclusions that can be drawn regarding these variables and the GLT FDI 
system are the same as those that were drawn regarding the EVT parity- 
equation residuals and algorithms presented in Section 8.4. They are 
not repeated here. 

The failure-detection thresholds obtained for the GLT algorithm 
are presented in Figure 20 for the gyros and in Figure 21 for the accel- 
erometers. The constant portions of the thresholds used to account for 
high-frequency effects are the same ones used for the EVT algorithm pre- 
sented in Table 5. The threshold levels obtained for the hard- and mid- 
failure channels with the GLT algorithm are the same as those obtained 
with the EVT algorithm. The soft-failure detection levels are slightly 
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Figure 19. Accelerometer failure-decision functions; 
GLT, no sensor failure. 
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Figure 20. TDOF gyro failure-detection thresholds: GLT. 
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greater for the GLT algorithm, with the base level being *1.0 degree 
per hour for the gyros and *1966 micro-g for the accelerometers. This 
conclusion reinforces a similar conclusion concerning the relative values 
of the ideal failure-detection levels of the GLT and EVT algorithms. 

The 1-degree-per-hour soft-failure-detection level is greater than the 
ideal level of 0,66 degree per hour. Without turbulence, this level was 
lowered to 0.71 degree per hour. 
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SECTION 10 


A COMPARISON OF THE EVT AND GLT ALGORITHMS 


A comparison may be drawn between the EVT and GLT algorithms based 
upon the results presented in this report. There are advantages and 
disadvantages to both approaches. 

Consider first the failure-detection capability of the two algo- 
rithms: uniform detectability of the first failure exists with both 

algorithms. The level of failure detected was the same for both systems 
for the hard- and mid-failure channels. At first glance, the results of 
Sections 8.3 and 9.3 imply that the edge-vector approach results in a 
slightly better soft-failure-detection capability for the first sensor 
failure. For example, the level of first failure which can be detected 
is 0.64 degree per hour for the EVT and 0.835 degree per hour for the GLT. 
This comparison is not quite fair, however, in that the performance of 
the FDI system is not considered. The probability of correct detection, 
missed alarm, etc., has not been taken into account. Therefore, a 
comparison based on the thresholds obtained directly via the technique 
presented can be misleading. 

In addition, for a given threshold, smaller failures are detected 
with the GLT algorithm. Furthermore, the thresholds for the GLT algo- 
rithm decrease as a function of the number of good instruments remaining 
in the cluster and the number of parity equations. This is not true for 
the thresholds associated with the EVT algorithm. The failure-detection 
sensitivity for both the GLT and EVT algorithms lessens with fewer 
instruments remaining in the cluster. For the thresholds determined in 
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this study, it can easily be shown that it is then possible to detect 
smaller failures with the GLT algorithm than with the EVT algorithm when 
fewer sensors are present in the cluster. Consider the case of detecting 
the third failure. For the GLT algorithm, the ideal threshold will be 
reduced by /l/5 (see Eq. (13)) to a value of 0.295 degree per hour, since 
only one parity equation is used. The ideal threshold for the EVT 
algorithm remains the same. The minimum failure-detection sensitivity is 
0.1830 for the GLT algorithm and 0.2558819 for the EVT algorithm. There- 
fore, the largest third failure not detected by the GLT algorithm is 
1.612 degrees per hour, while failures up to 1.749 degrees per hour may 
go undetected with the EVT algorithm. 

Additional qualitative comparisons of the FDI capability possible 
with the EVT and GLT algorithms can be made from a consideration of 
Sections 8.2 and 9.2. The FDI capability associated with the GLT algo- 
rithm has the advantage of being more uniform, particularly for the first 
and second failures. This is based on the failure-detection sensitivity 
coefficients presented in Tables 4 and 8. It is only when the third 
failure is being detected that a small failure-detection sensitivity 
occurs for the GLT algorithm. In contrast, a small failure-detection 
sensitivity occurs when detection of the second failure with the EVT 
algorithm is attempted. 

It also appears that the GLT is superior to the EVT with regard to 
the wrong isolation of single-axis failures- This conclusion comes from 
a consideration of Tables 4 and 9 and the discussion associated with them. 
The probability of the wrong isolation of a failure should be less for 
the GLT algorithm than for the EVT algorithm because of the large differ- 
ence in the magnitude of the isolation coefficients given in Table 9. 

For the EVT, the probability of wrong failure isolation appears to be 
much greater as indicated by the discussion in Section 8.2. It is only 
with the isolation of the second failure that the GLT appears vulnerable 
to wrong isolation, but the EVT also suffers in this regard. It is felt 
that the GLT algorithm is superior to the EVT algorithm in its ability to 
correctly isolate the second failure. 
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The EVT algorithm appears to have an advantage in terms of 
computer memory required. The GLT algorithm requires that different 
sets of parity equations be stored. In addition, the switching logic 
that goes along with the selection of the proper set of equations and 
the ordering of the sensors associated with the use of these equations 
could be quite complex. The EVT is very straightforward from this 
point of view. However, computer memory is rarely a limiting factor 
with regard to system software. The major limitation arises because of 
the throughput required with repetitive calculations. It is on this 
basis that the software requirements of the two algorithms will be 
judged. The two algorithms appear to be about equal in this respect. 

The two algorithms also have the ability to detect TDOF failures. 
The EVT is transparent to most TDOF failures as both axes are included 
in any parity equation using a given sensor. For the GLT, the failure- 
decision function is the same for SDOF and TDOF failures. However, 
different failure-isolation decision functions exist as given by Eq. (12) 
and (13) . 

In the case of a null failure, where a sensor yields a zero 
output, both algorithms should function properly and detect and isolate 
the correct failure. This has been demonstrated via simulation. The 
reason that this is true is that the basic property of a parity-equation 
system, i.e., VH = 0, no longer holds. The introduction of a null 
failure may be looked upon as the introduction of a failure of the 
opposite sign and magnitude equal to the parity-equation element times 
the failed-sensor output. For example, the first parity equation for the 
GLT algorithm may be written as 


= + 




+ • • 


+ V, m 
In n 


If m^ fails (goes to zero) the V^^m^ term disappears. This may also be 
interpreted as the introduction into the system of a failure of magni- 
tude ^ failure of this magnitude is large enough that detection 

and isolation should be relatively easy. 
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SECTION 11 


SUMMARY AND CONCLUSIONS 


The major result of this study was the demonstration of the 
feasibility of performing FDI for the redundant IMU of interest in an 
air-transport-vehicle environment. Acceptable performance was obtained 
for a range of failures from hard (or extremely large ones) down through 
the soft ones which affect the navigation performance of the system. The 
detection and isolation of failures down to the range of 0.5 degree per 
hour for the gyros and 1500 micro-g for the accelerometers was clearly 
demonstrated . 

In addition, a methodology was developed for the design and 
evaluation of fault-tolerant systems for the redundant IMU. This method- 
ology can be used as a baseline for the development of a more refined 
algorithm which considers the specific characteristics of the instruments 
to be used in the actual system and the physical separation of the 
components of the IMU as they will actually be implemented in the vehicle. 

The development of failure-detection thresholds was a major 
consideration in the development of the FDI system. The need for dynamic 
failure-detection thresholds was demonstrated, particularly for the 
soft-failure gyro FDI channel. An algorithm was developed for the 
generation of these thresholds as a function of the vehicle environment. 
The thresholds consist of a constant portion to account for high-frequency 
sensor noise and a dynamic portion to account for the effects of vehicle 
dynamics. 
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The FDI system for the gyros could possibly require only constant 
thresholds for the hard- and mid-failure channels. The capability for 
the channels was shown to be =250 degrees per hour for the hard failures 
and =36 degrees per hour for the mid-value failures. Dynamic thresholds 
are needed for the soft-failure channel, with detectability in the range 
of 0.5 to 0.7 degree per hour possible. It was not possible to give an 
advantage to either algorithm since the probabilities of FDI system 
performance were not accounted for. 

The accelerometer FDI system has its own unique characteristics. 
Constant thresholds could quite possibly be used for the whole system. 
Since the hard- failure-detection level is low (=8000 micro-g) , the need 
for a mid-failure channel is moot. A soft-failure-detection capability 
in the vicinity of 1500 micro-g was demonstrated. 

The GLT and EVT algorithms were compared from the standpoint of 
their FDI capability. Approximately the same failure-detection capa- 
bility was achieved with both algorithms. However, the GLT has an 
advantage with regard to the detection of the second and third soft 
failures, since the thresholds for this algorithm decrease as a function 
of the number of sensors remaining in the system. This helps to offset 
the decrease in failure-detection sensitivity which comes about with 
fewer sensors. It was also shown that the failure-detection sensitivity 
of the GLT algorithm is more uniform than that of the EVT. The GLT 
algorithm also has an advantage over the EVT algorithm with regard to the 
ability of the algorithm to correctly isolate a sensor failure. Finally, 
it should be noted that both the algorithms will be unaffected by most 
credible TDOF sensor failure modes. The same is true for null failures. 

The EVT algorithm will require less computer memory than the GLT 
algorithm. This is not a major advantage, however, since computer 
throughput is the limiting factor in software design and implementation. 
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